Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-45563Roxy-WI: IDOR — any authenticated user can read another user's full action history

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in roxy-wi from roxy-wi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 92.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<server_ip> re-uses the server_ip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
roxy-wi	roxy-wi	<= 8.2.6.4

Weakness: CWE-639, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9 x_refsource_CONFIRM